1. Data Controller
Espaço Talassa – Exploração Turística Marítima, Lda. Rua dos Baleeiros, 9930 Lajes do Pico, Azores, Portugal Tax ID (NIF): 512 025 240 Travel Agency Licence: RNAVT 6541 Email: espacotalassa@espacotalassa.com Phone: (+351) 292 672 010 Website: www.espacotalassa.com
2. Scope and Purpose
This Privacy Policy describes how Espaço Talassa collects, uses, stores and protects the personal data of users of the website www.espacotalassa.com and of clients who book or use our whale watching, outdoor activity and accommodation services.
This policy complies with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and applicable Portuguese legislation (Law No. 58/2019).
3. Personal Data We Collect
In the course of our activity, we may collect the following personal data:
Identification and contact data: full name, email address, phone number, nationality, country of residence and postal address.
Booking data: preferred dates, type of activity or accommodation, number of participants, information about minors (age), relevant health conditions for the practice of activities (e.g. pregnancy, reduced mobility), dietary preferences or other information provided by the client.
Payment data: payment method used. Credit card details are processed exclusively by the payment service provider and are never stored on our systems.
Browsing data: IP address, browser type, operating system, pages visited, visit duration and cookies (see section 8).
Communication data: content of emails, messages sent through contact forms and telephone call records, where applicable.
4. Purposes of Processing and Legal Basis
| Purpose | Legal Basis (GDPR) |
|---|---|
| Managing and confirming bookings for whale watching, activities and accommodation | Performance of a contract (Art. 6(1)(b)) |
| Payment processing and invoicing | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Communication with the client before, during and after services | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Ensuring participant safety during maritime and outdoor activities | Legitimate interest and protection of vital interests (Art. 6(1)(d) and (f)) |
| Sending newsletters and promotional communications | Consent (Art. 6(1)(a)) |
| Compliance with legal, tax and regulatory obligations (e.g. tourism registration) | Legal obligation (Art. 6(1)(c)) |
| Website improvement and statistical analysis of usage | Legitimate interest (Art. 6(1)(f)) |
| Collecting statistical data on cetacean sightings for research and conservation purposes | Legitimate interest and public interest (Art. 6(1)(e) and (f)) |
5. Data Sharing
Your personal data may be shared with the following categories of entities, strictly to the extent necessary for the purposes described:
- Payment service providers (Stripe, Reduniq or other electronic payment providers), for secure transaction processing.
- Booking platforms (Bókun and/or other channel managers), for availability and booking management.
- Public authorities, where required by law (e.g. Turismo de Portugal, tax authorities, maritime authorities).
- Scientific research partners, in the case of sighting data — always in anonymised form.
We do not sell, rent or share your personal data with third parties for marketing purposes.
6. International Transfers
Some of our service providers (e.g. email platforms, booking systems) may be located outside the European Economic Area. In such cases, we ensure that data transfers are carried out on the basis of appropriate safeguards under the GDPR, namely European Commission adequacy decisions or standard contractual clauses.
7. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected:
- Booking and invoicing data: 10 years, as required by Portuguese tax legislation.
- Communication data (emails, forms): up to 2 years after the last contact.
- Newsletter data: until the subscriber cancels the subscription.
- Browsing data and cookies: in accordance with the periods set out in section 8.
8. Cookies
The website www.espacotalassa.com uses cookies to ensure proper functioning and to improve the user experience.
Strictly necessary cookies: essential for the operation of the website (e.g. session, language). These do not require consent.
Analytics/performance cookies: allow us to understand how visitors use the site (e.g. Google Analytics). Collected only with your consent.
Marketing cookies: used to display relevant content (e.g. social media, remarketing). Collected only with your consent.
You can manage your cookie preferences at any time via the cookie banner displayed on the site or through your browser settings.
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — request deletion of your data where there is no legal basis for its retention.
- Right to restriction of processing — restrict the processing of your data in certain circumstances.
- Right to data portability — receive your data in a structured, commonly used format.
- Right to object — object to the processing of your data on the basis of legitimate interest or for direct marketing purposes.
- Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise any of these rights, please contact us at espacotalassa@espacotalassa.com, stating your full name and the right you wish to exercise. We will respond within 30 days.
If you believe that your rights have not been properly safeguarded, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.
10. Data Security
Espaço Talassa adopts appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including encrypted communications (SSL/TLS), access controls and internal security procedures.
11. Children’s Data
We do not intentionally collect personal data from children under 16 without the consent of the holder of parental responsibility. When minors participate in our activities, data is provided and consented to by the responsible adult.
12. Changes to this Policy
Espaço Talassa reserves the right to update this Privacy Policy at any time. Any changes will be published on this page with the revised update date. We recommend that you check this page periodically.
13. Contact
For questions related to the protection of personal data:
Espaço Talassa – Exploração Turística Marítima, Lda. Email: espacotalassa@espacotalassa.com Phone: (+351) 292 672 010 Address: Rua dos Baleeiros, 9930 Lajes do Pico, Azores, Portugal